CVE-2026-58369: Woodpecker DoS Vulnerability

CVE-2026-58369 Overview

CVE-2026-58369 is a NULL pointer dereference vulnerability [CWE-476] in Woodpecker CI versions before 3.15.0. The /api/orgs/lookup/*org_full_name endpoint is registered without authentication middleware. The LookupOrg handler unconditionally dereferences the session user via user.ForgeID through ForgeFromUser. Unauthenticated requests return a nil session user, triggering a panic on every request.

Gin's recovery middleware catches the panic and returns HTTP 500, keeping the server running. However, each request writes roughly 37 lines of stack trace to the error log, enabling a low-bandwidth log-flooding denial of service.

Critical Impact
An unauthenticated remote attacker can repeatedly probe the endpoint to inflate log volume, exhaust disk capacity, drive up log-ingestion costs, and bury legitimate security events.

Affected Products

Woodpecker CI versions prior to 3.15.0
Woodpecker CI server component (server/api/org.go)
Deployments exposing the /api/orgs/lookup/* endpoint to untrusted networks

Discovery Timeline

2026-06-30 - CVE-2026-58369 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58369

Vulnerability Analysis

Woodpecker is an open-source continuous integration engine. The /api/orgs/lookup/*org_full_name route was registered outside the authenticated middleware chain, making it reachable without credentials. Inside the LookupOrg handler, the code calls session.User(c) and then immediately reads user.ForgeID to select the forge for the database lookup.

For an unauthenticated request, session.User(c) returns nil. Dereferencing the nil pointer causes a Go runtime panic. Gin's recovery middleware intercepts the panic, logs the full goroutine stack trace, and responds with HTTP 500. The server remains available, but each probe generates approximately 37 lines of error-log output.

An attacker with minimal bandwidth can loop requests against the endpoint to amplify log volume orders of magnitude beyond request size. This produces disk pressure, elevated SIEM ingestion cost, and log noise that hides real events.

Root Cause

Two defects combine to produce the vulnerability. First, the route is missing the authentication middleware that protects other org endpoints. Second, the handler assumes a non-nil session user without validating the return value of session.User(c) before dereferencing user.ForgeID.

Attack Vector

The attacker sends unauthenticated HTTP GET requests to /api/orgs/lookup/<any_name> on an exposed Woodpecker server. No credentials, tokens, or user interaction are required. The following patch from the upstream fix shows the corrected handler logic.

	orgFullName := strings.TrimLeft(c.Param("org_full_name"), "/")

	var org *model.Org
	if user == nil {
		org, err = _store.OrgLookup(orgFullName)
		if err != nil {
			if err.Error() == "found more than one org with this name" {
				_ = c.AbortWithError(http.StatusBadRequest, err)
				return
			}
			handleDBError(c, err)
			return
		}
	} else {
		org, err = _store.OrgFindByName(orgFullName, user.ForgeID)
		if err != nil {
			handleDBError(c, err)
			return
		}
	}

	// don't leak private org infos
	if org.Private {
		if user == nil {

Source: GitHub Woodpecker Commit 1fbacac

Detection Methods for CVE-2026-58369

Indicators of Compromise

Repeated HTTP 500 responses from /api/orgs/lookup/* in Woodpecker access logs
Panic stack traces referencing LookupOrg, ForgeFromUser, or user.ForgeID in the server error log
Sudden growth in log volume or disk usage on Woodpecker server hosts
High-rate anonymous requests to /api/orgs/lookup/ from a single source IP or small IP set

Detection Strategies

Alert on repeated runtime error: invalid memory address or nil pointer dereference panics in Woodpecker error logs
Correlate spikes in HTTP 500 responses to /api/orgs/lookup/ with source IPs lacking valid session cookies
Baseline normal error-log line rate and trigger on statistical deviation

Monitoring Recommendations

Ingest Woodpecker server logs into a centralized log platform and set volume-anomaly thresholds
Add a reverse proxy access log filter for the /api/orgs/lookup/ path and monitor request rate per client
Track free disk space on Woodpecker hosts and alert before exhaustion

How to Mitigate CVE-2026-58369

Immediate Actions Required

Upgrade Woodpecker to version 3.15.0 or later, which contains the fix from pull request #6652
Restrict inbound network access to the Woodpecker API to trusted networks or authenticated proxies
Rotate any log-storage capacity alerts to fire earlier while patching is in progress

Patch Information

The fix is included in Woodpecker v3.15.0. The patch, applied in commit 1fbacac, adds a nil check for the session user and routes anonymous lookups through OrgLookup instead of OrgFindByName. Additional context is available in the Vulncheck Security Advisory.

Workarounds

Block unauthenticated requests to /api/orgs/lookup/ at a reverse proxy or web application firewall until the upgrade is applied
Rate-limit anonymous requests to the Woodpecker API to reduce log amplification
Rotate and compress error logs aggressively to limit disk consumption while patching

bash

# Example nginx block to deny unauthenticated access to the vulnerable endpoint
location ~ ^/api/orgs/lookup/ {
    if ($http_authorization = "") { return 401; }
    if ($cookie_user_sess = "") { return 401; }
    proxy_pass http://woodpecker_upstream;
}